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REMARKS 

These remarks are responsive to the Office Action mailed January 20, 2004. Claims 
1-31 were rejected. Claims 1-31 remain pending in the application and are presented for 
reconsideration and allowance. 

Claim Rejections under 35 V.S.C. 8 103 

Claims 1-31 are rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. 
Patent No. 6,405,251 by Bullard et al. ("Bullard") in view of U.S. Patent No. 5,970,490 by 
Morgenstern ("Morgenstern"). Applicant submits that the Bullard reference alone or in 
combination with the Morgenstern reference fails to disclose, teach, or suggest the invention 
of independent claims 1, 13, 17, 24, 26 and 30. 

Independent claim 1 recites a method for recording network usage. The method 
comprises defining a network data collector including an encapsulator, an aggregator, and a 
data storage system. A set of network accounting data is received via the encapsulator. A 
network accounting data set is converted to a standard data format. The network accounting 
data set is processed via the aggregator, including defining a rule chain and applying the rule 
chain to the network accounting data set to construct an aggregation tree including creating 
an aggregated network accounting data set. The aggregated network accounting data set is 
stored in the data storage system. 

Bullard discloses a system for enhancement of network accounting records. The 
system includes a data collector layer 18 that is a distributed layer of individual data 
collectors. The data collectors collect raw accounting information and convert data into 
normalized records referred to as network accounting records (NARs). Each of the data 
collectors forwards network accounting records to a flow aggregation process 60. (See 
column 3, lines 43-54). The flow aggregation process 60, including aggregation processor 
13, is a central collection point for all network accounting records produced from various 
data collectors in the data collection layer 18. The flow aggregation processor 60 aggregates 
and/or enhances record data across the network devices to produce summary NARs' (column 
4, lines 1-26), and (column 18, lines 39-49). The data can be further enhanced and/or 
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reduced (i.e., aggregated) to meet the specific needs of an application or output interface 
based on the aggregation policy of the flow data processor 60. 

Morgenstern discloses an integration system for processing heterogeneous data from 
multiple sources. The integration system utilizes an interoperability assistant module 20 
(figure 2) including specifications for transforming the heterogeneous data into a common 
intermediate representation of the heterogeneous data using the specifications and creating an 
information bridge with the interoperability assistant module through a process of program 
generation. (See col. 1, lines 10-17). The system provides high-level user interfaces and 
program level access across heterogeneous databases, allowing immigration of a wide variety 
of information resources including relational and object databases, CAD design tools, 
simulation packages, data analysis and visualization tools, and other software modules. (Col. 
3, lines 7-13). 

High level transformation rule specifications (HLTRS) are utilized by the system to 
transform data from a source data representation to a target data representation. (See col. 8, 
lines 5-8). The HLTRS are sent to a transformer generator 42, which generates code files that 
describe the transformation rules in a form usable by a dependency graph 200 (see figure 4), 
which controls the data flow from source to target. (Col. 8, lines 53-57). Dependency graph 
200 is the basis for rule execution. Dependency graph 200 is composed of an input tree 210, 
a rule graph 220, and an output tree 230. (See fig. 4 and col. 20, lines 46-50). Input data 
instances are first inserted into the input tree. The data instances are then passed by the input 
tree to the rule graph, together with completion signals. The rule graph 220 will apply 
specified transformation rules on the data instances to generate intermediate instances and 
output instances. The final rules of the rule graph insert the output instances into the output 
tree 230, which assembles and eventually outputs them accordingly. (Col. 21, lines 19-23). 

The examiner conceded that Bullard does not teach processing the network 
accounting data set via the aggregator, including the steps of defining a rule chain and 
applying the rule chain to the network accounting data set to construct an aggregation 
tree including creating an aggregated network accounting data set. (Office Action, pg. 
3). The examiner submits that this limitation is taught by Morgenstern. 
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Morgenstern does not disclose defining a rule chain and applying the rule chain to 
the network accounting data to construct an aggregation tree including creating an 
aggregated network accounting data set as claimed by Applicant. Morgenstern merely 
discloses a rule graph 220 and the input tree 210 and output tree 230. The rule graph 220 is a 
directed graph and consists of data nodes and rule nodes. Each rule node is connected to one 
or more input data nodes and no more than one output data node. (See col. 21, lines 41-44). 
Rule graph 220 is not a rule chain as claimed by Applicant. In view of the above, one skilled 
in the art could not combine the teachings of Bullard in view of Morgenstern and arrive at the 
present invention of independent claim 1 . 

Further, Bullard and Morgenstern fail to teach or suggest such a combination. 
Morgenstern is directed to a method for processing heterogeneous data and does not even 
relate to collecting network accounting data. In view of the above, Applicants respectfully 
submit that the above rejection of independent claim 1 under 35 U.S.C. 103(a) should be 
withdrawn. 

Dependent claims 2-12 depend directly or indirectly upon independent claim 1. 
Accordingly, dependent claims 2-12 are also allowable over the art of record. 

Bullard, either alone or in combination with Morgenstern, also does not teach or 
suggest the claim recitations in independent claim 13. Claim 13 recites a method for 
recording network usage including correlating of network usage information and network 
session information. The method includes defining a network data correlator collector 
including an encapsulated an aggregator, and a data storage system. A set of network session 
data is received via the encapsulator. The network session data set is processed via the 
aggregator, including the steps of defining a first rule chain and applying the first rule chain 
to the network session data to construct an aggregation tree. A set of network usage data is 
received via the encapsulator. The network usage data set is processed via the aggregator, 
including the steps of defining a second rule chain and applying the second rule chain to the 
network usage data and the aggregation tree to construct a correlated aggregation tree. A 
correlated data set is determined from the correlated aggregation tree. The correlated data set 
is stored in the data storage system. Bullard and Morgenstern do not teach or suggest these 
claim recitations. 
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As discussed above, Bullard fails to disclose processing a network session data set 
via the aggregator, including the steps of defining a first rule chain and applying the 
first rule chain to the network session data to construct an aggregation tree, and 
processing a network usage data set via the aggregator, including the steps of defining a 
second rule chain and applying the second rule chain to the network usage data and the 
aggregation tree to construct a correlated aggregation tree. 

Morgenstern also does not disclose defining a first rule chain and applying the first 
rule chain to the network session data to construct an aggregation tree and defining a 
second rule chain and applying the second rule chain to the network usage data and the 
aggregation tree to construct a correlated aggregation tree as claimed by Applicant. In 
view of the above, one skilled in the art could not combine the teachings of Bullard in view 
of Morgenstern and arrive at the present invention of independent claim 13. Accordingly, 
Applicant respectfully submits that the above rejection of independent claim 13 under 35 
U.S.C. 103(a) should be withdrawn. 

Dependent claims 14-16 depend directly or indirectly upon independent claim 13. 
Accordingly, dependent claims 14-16 are also allowable over the art of record. 

Bullard, either alone or in combination with Morgenstern, also does not teach or 
suggest the claim recitations in independent claim 17. Claim 17 recites a method for 
recording network usage. The method includes defining a first network data collector 
including a first encapsulator, a first aggregator, and a first data storage system. A first set of 
network data is received via the first encapsulator. The first network data set is processed via 
the first aggregator, including the steps of defining an aggregation rule chain in determining a 
first set of aggregated data by applying the aggregation rule chain to the first set of network 
data. The first aggregated network data set is stored in the first data storage system. Bullard 
and Morgenstern do not teach or suggest these claim recitations. Applicant respectfully 
submits that the above rejection of independent claim 17 under 35 U.S.C. 103(a) should be 
withdrawn. 

Dependent claims 18-23 depend directly or indirectly upon independent claim 17. 
Accordingly, these dependent claims are allowable over the art of record. 
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Bullard, either alone or in combination with Morgenstern, also does not teach or 
suggest the claim recitations in independent claim 24. Claim 24 recites a network usage 
recording system having a network data collector. The network data collector includes an 
encapsulator for receiving a set of network accounting data and converting the network 
accounting data set to a standard data format. An aggregator processes the network 
accounting data set, the aggregator including a defined rule chain, wherein the aggregator 
applies the rule chain to the network accounting data set to construct an aggregation tree, and 
determines a set of aggregated network accounting data from the aggregation tree. A data 
storage system stores the aggregated network accounting data. Bullard and Morgenstern do 
not teach or suggest these claim recitations. Applicant respectfully submits that the above 
rejection of independent claim 24 under 35 U.S.C. 103(a) should be withdrawn. 

Dependent claim 25 depends directly upon independent claim 24. Accordingly, this 
dependent claim is allowable over the art of record. 

Bullard, either alone or in combination with Morgenstern, also does not teach or 
suggest the claim recitations in independent claim 26. Claim 26 recites a network usage 
recording system having a network data correlator collector. The network data correlator 
collector includes an encapsulator which receives a set of network session data. An 
aggregator for processing the network session data set, the aggregator including a defined 
first rule chain wherein the aggregator applies the first rule chain to the network session data 
set to construct an aggregation tree. The encapsulator receives a set of network usage data, 
and the aggregator processes the network usage data set, the aggregator including a defined 
second rule chain, wherein the aggregator applies the second rule chain to the network usage 
data set and the aggregation tree to construct a correlated aggregation tree, and determines a 
correlated data set from the correlated aggregation tree. A data storage system stores the 
correlated data set. Bullard and Morgenstern do not teach or suggest these claim recitations. 
Applicant respectfully submits that the above rejection of independent claim 26 under 35 
U.S.C. 103(a) should be withdrawn. 

Dependent claims 27-29 depend either directly or indirectly upon independent claim 
26. Accordingly, these dependent claims are allowable over the art of record. 
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Bullard, either alone or in combination with Morgenstern, also does not teach or 
suggest the claim recitations in independent claim 30. Claim 30 recites defining a first 
network data collector including a first encapsulator, a first aggregator, and a first data 
storage system. A first set of network data is received via the first encapsulator. The first 
network data set is processed via the first aggregator, including defining an aggregation rule 
chain and determining a first set of aggregated data by applying the aggregation rule chain to 
the first set of network data. The first aggregated network data set is stored in the first data 
storage system. 

Applying the aggregation rule chain to the first set of network data further comprises 
constructing an aggregation tree. The first aggregated network data set is determined from 
the aggregation tree, where constructing an aggregation tree includes defining the first 
network data set to include a first network data event and a second network data event. The 
aggregation rule chain is applied to the first network data event to construct a hierarchy of 
group nodes within the aggregation tree. The aggregation rule chain is applied to the second 
network data event to locate similar group nodes according to a predefined set of match rules, 
if no matching group nodes exist, the hierarchy of group nodes is extended within the 
aggregation tree by creating additional group nodes. 

Applying the aggregation rule chain to the first network data event further includes 
defining the aggregation rule chain to include a first match rule for matching source IP 
address. The first network data event is defined to include a first source IP address. The first 
match rule is applied to the first network data event, including determining whether the 
aggregation tree includes a first group node matching the first source IP address, and if a 
matching first group node does not exist, creating the first group node for the first source IP 
address. 

Applying the aggregation rule chain to the first network data event includes defining 
the aggregation rule chain to include a second match rule for matching destination IP address. 
The first network data event is defined to include a first destination IP address. The second 
match rule is applied to the first network data event, including determining whether the 
aggregation tree includes a second group node matching the first destination IP address, and 
if a matching second group node does not exist, creating the second group node for the first 
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destination IP address. Applying the aggregation rule chain to the first network data event 
further includes defining the aggregation rule set to include an aggregation rule. The first 
network data event is defined to include a port number and volume of information. The 
aggregation rule is applied to the first network data event, including copying the port number, 
source IP address, destination IP address and volume information to the second group node. 
Bullard and Morgenstern do not teach or suggest these claim recitations. Applicant 
respectfully submits that the above rejection of independent claim 30 under 35 U.S.C. 103(a) 
should be withdrawn. 

Dependent claim 31 depends directly upon independent claim 30. Accordingly, this 
dependent claim is allowable over the art of record. 
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CONCLUSION 

In light of the above, Applicant believes independent claims 1, 13, 17, 24, 26 and 30 
and the claims depending therefrom, are in condition for allowance. Allowance of these 
claims is respectfully requested. 

Any inquiry regarding this Amendment and Response should be directed to either 
Philip S. Lyren at Telephone No. (281) 514-8236, Facsimile No. (281) 514-8332 or Steven 
E. Dicke at Telephone No. (612) 573-2002, Facsimile No. (612) 573-2005. In addition, all 
correspondence should continue to be directed to the following address: 

Hewlett-Packard Company 

Intellectual Property Administration 
P.O. Box 272400 

Fort Collins, Colorado 80527-2400 

Respectfully submitted, 

Alexander C. Ranous et al., 

By their attorneys, 

DICKE, BILLIG & CZAJA, PLLC 
Fifth Street Towers, Suite 2250 
100 South Fifth Street 
Minneapolis, MN 55402 
Telephone: (612) 573-2002 
Facsimile: (612) 573-2005 ^ 

Date: 

SEDrjan ^ Steven E. Dicke 
Reg. No. 38,431 



CERTIFICATE UNDER 37 C.F.R. 1.8 : The undersigned hereby certifies that this paper or papers, as described herein, 
are being deposited in the United States Postal Service, as first class mail, in an envelope address to: Commissioner for 
Patents, P.O. Box 1450, Alexandria, VA 223 13-1450 on this day of April, 20M- . 

Name: Steven E. Dicke 
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